Major Exchange launches bounty after $387M hack

TLDR

Crypto exchange Bitget has confirmed a roughly $387.5 million wallet breach and is now offering recovery bounties to incentivize freezing and returning the stolen funds.

1. Bitget revised losses to about $387.5 million from hot and warm wallets, saying the incident is contained and covered by its protection fund.
2. The exchange launched a bounty program paying 5 percent of frozen assets and 5 percent of recovered funds, plus a public tracing dashboard.
3. Withdrawals remain paused while security checks continue, and the case highlights growing state linked exchange risk and the importance of venue safety.

Deep Dive

1. Size And Nature Of The Breach

Bitget raised its estimate of assets affected by the September 24 security incident from $351.6 million to about $387.5 million after on chain tracing added previously missed Zcash and TRON transfers, stressing this reflects fuller accounting rather than new thefts, and that the vulnerability is now fixed and contained raised its estimate to about $387.5 million and launched a recovery bounty.

The breach hit parts of its internet connected hot and warm wallet infrastructure across EVM networks, XRP Ledger, Zcash and TRON, while offline cold wallets remained secure and customer balances are said to be accurate confirmed that about $387.5 million was moved to attacker addresses.

Bitget reports a User Protection Fund valued at over $464 million, largely in Bitcoin, which it says fully covers the loss, although a full payout could consume around 84 percent of that reserve and require replenishment could consume about 84 percent of its User Protection Fund.

2. How The Bounty Program Works

To improve recovery, Bitget has launched a crowd sourced bounty program that pays 5 percent of any attacker funds that partners help freeze and another 5 percent of any assets they help recover, with earlier freezes also eligible offering 5 percent rewards and promising a withdrawal plan.

The campaign uses a public tracing dashboard, an API of attacker addresses and industry channels such as Bybits LazarusBounty platform, and Bitget says some wallets are already frozen, including blacklisted stablecoin addresses, though the recovered amount is still undisclosed has provided a tracing dashboard and launched a Recovery Bounty Program.

3. User Impact And Security Signals

Deposits and trading continue, but withdrawals are paused while Bitget completes its security review, with the company promising a withdrawal restoration plan by September 26 at 04:00 UTC and warning that timing could still shift offering 5 percent rewards and promising a withdrawal plan.

Bitgets CEO has said investigators identified IP patterns similar to prior North Korea operations and that a Lazarus linked group is a leading suspect, though attribution remains officially unconfirmed and under law enforcement review suspects a North Korea linked hacking group.

For crypto users, this is one of the largest exchange incidents on record and reinforces that centralized venues carry nontrivial platform risk even when they maintain protection funds and good communication.

Conclusion

Bitgets bounty backed response shows a more aggressive playbook for recovering hacked exchange funds, but the underlying story is still a nearly $387.5 million breach that heavily strains its protection reserve.

Whether the bounty model meaningfully reduces final losses, and how quickly Bitget safely restores withdrawals, will shape both user confidence in the exchange and wider norms for post incident recovery across centralized platforms.